chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-23 10:13:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
d17270bbe2
prole/supabase/helm/knoe-supabase/templates/kong/config.yaml

305 lines
10 KiB
YAML
Raw Blame History

{{- if .Values.deployment.kong.enabled -}}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "supabase.kong.fullname" . }}
labels:
{{- include "supabase.labels" . | nindent 4 }}
data:
wrapper.sh: |
#!/bin/bash
set -euo pipefail
echo "Replacing env placeholders of /usr/local/kong/kong.yml"
sed \
-e "s|\${SUPABASE_ANON_KEY}|${SUPABASE_ANON_KEY}|" \
-e "s|\${SUPABASE_SERVICE_KEY}|${SUPABASE_SERVICE_KEY}|" \
-e "s|\${DASHBOARD_USERNAME}|${DASHBOARD_USERNAME}|" \
-e "s|\${DASHBOARD_PASSWORD}|${DASHBOARD_PASSWORD}|" \
/usr/local/kong/template.yml \
> /usr/local/kong/kong.yml
exec /docker-entrypoint.sh kong docker-start
template.yml: |
_format_version: '2.1'
_transform: true
consumers:
{{- if .Values.secret.dashboard }}
- username: DASHBOARD
{{- end }}
- username: anon
keyauth_credentials:
- key: ${SUPABASE_ANON_KEY}
- username: service_role
keyauth_credentials:
- key: ${SUPABASE_SERVICE_KEY}
acls:
- consumer: anon
group: anon
- consumer: service_role
group: admin
{{- if .Values.secret.dashboard }}
basicauth_credentials:
- consumer: DASHBOARD
username: ${DASHBOARD_USERNAME}
password: ${DASHBOARD_PASSWORD}
{{- end }}
services:
# Dedicated health endpoint used by the GCE LB BackendConfig.
# request-termination returns 200 synchronously without hitting any
# upstream, so the probe passes as long as the Kong proxy itself is
# accepting requests -- same liveness semantics as the TCP check we
# originally wanted, but using the HTTP protocol that GCE's L7
# BackendConfig CRD actually accepts (TCP is rejected with
# `Protocol "TCP" is not valid, must be one of [HTTP,HTTPS,HTTP2]`).
#
# URL is a RFC-2606 reserved `.invalid` hostname that never resolves.
# We originally tried `http://127.0.0.1:8000/` here, which is Kong's
# own proxy port -- this crashlooped the pod on startup (rollout timed
# out waiting for new pod to become Ready). Suspected cause: Kong's
# declarative-config parser rejects the self-reference. Since the
# request-termination plugin short-circuits before any DNS lookup or
# upstream connection, using a non-resolvable placeholder URL is
# equivalent in behavior but avoids the loop detection.
- name: healthz
url: http://knoe.healthz.invalid/
routes:
- name: healthz
strip_path: true
paths:
- /healthz
plugins:
- name: request-termination
config:
status_code: 200
message: ok
{{- if .Values.deployment.auth.enabled }}
- name: auth-v1-open
url: http://{{ include "supabase.auth.fullname" . }}:{{ .Values.service.auth.port }}/verify
routes:
- name: auth-v1-open
strip_path: true
paths:
- /auth/v1/verify
plugins:
- name: cors
- name: auth-v1-open-callback
url: http://{{ include "supabase.auth.fullname" . }}:{{ .Values.service.auth.port }}/callback
routes:
- name: auth-v1-open-callback
strip_path: true
paths:
- /auth/v1/callback
plugins:
- name: cors
- name: auth-v1-open-authorize
url: http://{{ include "supabase.auth.fullname" . }}:{{ .Values.service.auth.port }}/authorize
routes:
- name: auth-v1-open-authorize
strip_path: true
paths:
- /auth/v1/authorize
plugins:
- name: cors
- name: auth-v1
_comment: "GoTrue: /auth/v1/* -> http://{{ include "supabase.auth.fullname" . }}:{{ .Values.service.auth.port }}/*"
url: http://{{ include "supabase.auth.fullname" . }}:{{ .Values.service.auth.port }}
routes:
- name: auth-v1-all
strip_path: true
paths:
- /auth/v1/
plugins:
- name: cors
- name: key-auth
config:
hide_credentials: false
- name: acl
config:
hide_groups_header: true
allow:
- admin
- anon
{{- end }}
{{- if .Values.deployment.rest.enabled }}
- name: rest-v1
_comment: "PostgREST: /rest/v1/* -> http://{{ include "supabase.rest.fullname" . }}:{{ .Values.service.rest.port }}/*"
url: http://{{ include "supabase.rest.fullname" . }}:{{ .Values.service.rest.port }}/
routes:
- name: rest-v1-all
strip_path: true
paths:
- /rest/v1/
plugins:
- name: cors
- name: key-auth
config:
hide_credentials: true
- name: acl
config:
hide_groups_header: true
allow:
- admin
- anon
- name: graphql-v1
_comment: 'PostgREST: /graphql/v1/* -> http://{{ include "supabase.rest.fullname" . }}:{{ .Values.service.rest.port }}/rpc/graphql'
url: http://{{ include "supabase.rest.fullname" . }}:{{ .Values.service.rest.port }}/rpc/graphql
routes:
- name: graphql-v1-all
strip_path: true
paths:
- /graphql/v1
plugins:
- name: cors
- name: key-auth
config:
hide_credentials: true
- name: request-transformer
config:
add:
headers:
- Content-Profile:graphql_public
- name: acl
config:
hide_groups_header: true
allow:
- admin
- anon
{{- end }}
{{- if .Values.deployment.realtime.enabled }}
- name: realtime-v1-ws
_comment: "Realtime: /realtime/v1/* -> ws://{{ include "supabase.realtime.fullname" . }}:{{ .Values.service.realtime.port }}/socket/*"
url: http://{{ include "supabase.realtime.fullname" . }}:{{ .Values.service.realtime.port }}/socket
protocol: ws
routes:
- name: realtime-v1-ws
strip_path: true
paths:
- /realtime/v1/
plugins:
- name: cors
- name: key-auth
config:
hide_credentials: false
- name: acl
config:
hide_groups_header: true
allow:
- admin
- anon
- name: realtime-v1-rest
_comment: 'Realtime: /realtime/v1/* -> http://{{ include "supabase.realtime.fullname" . }}:{{ .Values.service.realtime.port }}/api/*'
url: http://{{ include "supabase.realtime.fullname" . }}:{{ .Values.service.realtime.port }}/api
protocol: http
routes:
- name: realtime-v1-rest
strip_path: true
paths:
- /realtime/v1/api
plugins:
- name: cors
- name: key-auth
config:
hide_credentials: false
- name: acl
config:
hide_groups_header: true
allow:
- admin
- anon
{{- end }}
{{- if .Values.deployment.storage.enabled }}
- name: storage-v1
_comment: "Storage: /storage/v1/* -> http://{{ include "supabase.storage.fullname" . }}:{{ .Values.service.storage.port }}/*"
url: http://{{ include "supabase.storage.fullname" . }}:{{ .Values.service.storage.port }}/
routes:
- name: storage-v1-all
strip_path: true
paths:
- /storage/v1/
plugins:
- name: cors
{{- end }}
{{- if .Values.deployment.functions.enabled }}
- name: functions-v1
_comment: 'Edge Functions: /functions/v1/* -> http://{{ include "supabase.functions.fullname" . }}:{{ .Values.service.functions.port }}/*'
url: http://{{ include "supabase.functions.fullname" . }}:{{ .Values.service.functions.port }}/
routes:
- name: functions-v1-all
strip_path: true
paths:
- /functions/v1/
plugins:
- name: cors
{{- end }}
{{/*
## Not used - Studio and Vector talk directly to analytics via Docker networking.
## If external access is needed, add routes with key-auth matching Logflare's x-api-key auth.
*/}}
{{/*
{{- if .Values.deployment.analytics.enabled }}
- name: analytics-v1
_comment: 'Analytics: /analytics/v1/* -> http://{{ include "supabase.analytics.fullname" . }}:{{ .Values.service.analytics.port }}/*'
url: http://{{ include "supabase.analytics.fullname" . }}:{{ .Values.service.analytics.port }}/
routes:
- name: analytics-v1-all
strip_path: true
paths:
- /analytics/v1/
{{- end }}
*/}}
{{- if .Values.deployment.meta.enabled }}
- name: meta
_comment: "pg-meta: /pg/* -> http://{{ include "supabase.meta.fullname" . }}:{{ .Values.service.meta.port }}/*"
url: http://{{ include "supabase.meta.fullname" . }}:{{ .Values.service.meta.port }}/
routes:
- name: meta-all
strip_path: true
paths:
- /pg/
plugins:
- name: key-auth
config:
hide_credentials: false
- name: acl
config:
hide_groups_header: true
allow:
- admin
{{- end }}
{{- if .Values.deployment.oauth2proxy.enabled }}
- name: dashboard
_comment: 'Studio via oauth2-proxy: /* -> http://{{ include "supabase.oauth2proxy.fullname" . }}:{{ .Values.deployment.oauth2proxy.port }}/*'
url: http://{{ include "supabase.oauth2proxy.fullname" . }}:{{ .Values.deployment.oauth2proxy.port }}/
routes:
- name: dashboard-all
strip_path: true
paths:
- /
plugins:
- name: cors
{{- else }}
- name: dashboard
_comment: 'Studio: /* -> http://{{ include "supabase.studio.fullname" . }}:{{ .Values.service.studio.port }}/*'
url: http://{{ include "supabase.studio.fullname" . }}:{{ .Values.service.studio.port }}/
routes:
- name: dashboard-all
strip_path: true
paths:
- /
{{- if .Values.secret.dashboard }}
plugins:
- name: cors
- name: basic-auth
config:
hide_credentials: true
{{- end }}
{{- end }}
{{- end }}
Reference in New Issue View Git Blame Copy Permalink